MiniABS 1.7: bundled TLS 1.2, no legacy HTTPS port needed

All requests (API, covers, downloads, the streaming proxy) go through Minamp's own
HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla roots, keep-alive, session
resumption) via NetConnection, a drop-in HttpURLConnection, as the iPod version does
with BearSSL. The phone reaches the normal https:// address directly; nothing changes
on the server.

- Trust: Mozilla roots + the user's pinned CAs/certificates feed the new verifier; the
  trust prompt, renew-safe CA pinning and forged-chain protection behave as before
- PATCH is a normal request now (no raw-socket path)
- Job, covers, player, downloads and proxy threads get big stacks for the handshake
- embedded Roots.java and gen_roots.py replaced by assets/roots
- tests: desktop shims read assets; all 104 checks pass (HTTP and HTTPS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AndroidManifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     package="com.miniabs"
-    android:versionCode="7"
-    android:versionName="1.6"
+    android:versionCode="8"
+    android:versionName="1.7"
     android:installLocation="auto">
 
     <uses-sdk android:minSdkVersion="8" android:targetSdkVersion="10" />

README.md

@@ -16,51 +16,21 @@ Sign in with your username and password, or tick "Use an API key instead". It wo
 
 ## HTTPS (from outside your home)
 
-Android 2.3 only speaks **TLS 1.0**, which modern servers refuse. So HTTPS needs one change on the server and is handled by the app from there.
-
-### Server: a legacy HTTPS port
-
-Add a second `server` block to nginx, on its own port, used only by the phone. Your normal HTTPS site stays strict.
-
-```nginx
-server {
-    listen 8443 ssl;
-    server_name abs.example.com;
-    ssl_certificate     /etc/letsencrypt/live/abs.example.com/fullchain.pem;  # must be an RSA certificate
-    ssl_certificate_key /etc/letsencrypt/live/abs.example.com/privkey.pem;
-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-    # @SECLEVEL=0 is required: OpenSSL 3 refuses TLS 1.0 without it
-    ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:AES128-SHA:@SECLEVEL=0";
-    ssl_prefer_server_ciphers on;
-    client_max_body_size 0;
-    location / {
-        proxy_pass http://127.0.0.1:13378;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_http_version 1.1;
-        proxy_buffering off;
-    }
-}
-```
-
-Then sign in with `https://abs.example.com:8443`.
-
-- **RSA certificate:** Android 2.3 can't use ECDSA certificates. With certbot, request one with `--key-type rsa`.
-- **Security:** TLS 1.0 with these ciphers is weak by today's standards, but much better than plain HTTP over the internet. Only open this port if you need it.
-- **Caddy** can't serve TLS 1.0; put nginx (or HAProxy) in front for this port.
+Android 2.3 only speaks TLS 1.0, which modern servers refuse, so since 1.7 MiniABS brings its own
+**TLS 1.2** (Bouncy Castle, the same client as Minamp, with Mozilla's root certificates,
+keep-alive and session resumption). Sign in with your server's normal `https://` address, at
+home or away; nothing changes on the server. (A legacy TLS 1.0 port set up for older versions
+keeps working too.)
 
 ### App: certificates
 
-- **Built-in roots:** MiniABS trusts what the phone trusts, plus modern root certificates the phone's 2011-era list lacks: Let's Encrypt, Google Trust Services, Sectigo/ZeroSSL, DigiCert G2, Amazon and others. Most certificates just work.
+- **Built-in roots:** MiniABS checks certificates against Mozilla's current root list (`assets/roots`), so Let's Encrypt, Google Trust Services, Sectigo/ZeroSSL and the rest just work.
 - **Anything else** (self-signed, a private CA, a new root): MiniABS shows the certificate's SHA-256 fingerprint and asks once. Compare it with the fingerprint your computer's browser shows for the site before tapping Trust. It then trusts the CA that issued it, so renewals keep working.
 - **Settings → Certificates you trusted** lets you forget them.
 
 ### App: streaming
 
-Android 2.x's media player can't stream https:// URLs, so for HTTPS servers MiniABS runs a small proxy on the phone (127.0.0.1 only, random unguessable URLs). It forwards seeks and gets a fresh sign-in token for each request, so long episodes don't break when the token expires.
+Android 2.x's media player can't stream modern https:// URLs, so for HTTPS servers MiniABS runs a small proxy on the phone (127.0.0.1 only, random unguessable URLs). It forwards seeks and gets a fresh sign-in token for each request, so long episodes don't break when the token expires.
 
 ## Using it
 
@@ -86,7 +56,7 @@ Playback opens an Audiobookshelf session and syncs every 15 seconds and on pause
 
 ## Building
 
-Needs a JDK, `aapt`, `dalvik-exchange` (dx), `zipalign`, `apksigner` (Ubuntu: `apt install aapt dalvik-exchange zipalign apksigner`) and an API 8 `android.jar`:
+Needs a JDK, `aapt`, `dalvik-exchange` (dx), `zipalign`, `apksigner` (Ubuntu: `apt install aapt dalvik-exchange zipalign apksigner`), an API 8 `android.jar`, and the renamed Bouncy Castle sources from Minamp's `tools/setup_toolchain.sh` (`BC_SRC`, default `~/android-toolchain/bcsrc`):
 
     ANDROID_JAR=/path/to/android-8/android.jar ./build.sh
 
@@ -94,6 +64,6 @@ Compiling against the API 8 jar guarantees no newer Android APIs are used. The A
 
 All sizes (text, rows, buttons, covers) are in `res/values/dimens.xml`; change them there and rebuild.
 
-`tools/gen_roots.py` regenerates the bundled root certificates from a system CA store.
+`src/com/miniabs/net/` is the bundled HTTP/TLS client shared with Minamp, FreshMini and GingerCal; `assets/roots/` holds Mozilla's roots (regenerate with Minamp's `tools/make_roots.py`).
 
 `test/run_tests.sh` runs the API, JSON, progress, HTTPS-trust and streaming-proxy code on the desktop JVM against a mock Audiobookshelf server (`test/mock_abs.py`), over plain HTTP and over TLS with good, expired, wrong-host, forged and self-signed certificates (`test/make_pki.sh`).